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Note No. #1 


2(10)/2020-CLES 

Ministry of Electronics & Information Technology 

(Cyber Law and e-Security Group) 

Subject: Guidelines for the data process protocol for 

Covidl9 related data 

This is with reference to the Ministry of Home Affairs order dated 29.03.2020 
regarding the constitution of Empowered Groups under the Disaster 
Management Act, 2005. 

1. An urgent need was felt to augment and synchronise efforts for 
containing the pandemic across various Ministries/ Departments. The 
empowered groups are empowered to 

1. identify problem areas and provide effective solutions therefor; 

ii. delineate policy; 

iii. formulate plans and strategize operations 

iv. take all necessary steps for effective and time bound implementation of 
these plans/policies/strategies/decisions in their respective areas 

2. One such committee has been established under Secretary, MeitY to 
look into issues pertaining to Technology and Data Management. 

3. Due to the outbreak of Covid-19 epidemic, a large number of health 
related data set of subjects is being collected through various regulatory 
measures of ICMR and NCDC. Government has also launched 
Aarogyasetu App which will be collecting lot of information regarding 
citizens of India. The App will be collecting health data with consent of 
the users. Presently all the data is being supervised by ICMR. As the 
quantum of data is getting exponentially high, it was felt that MeitY 
through NIC will become the Data Source. Also, there are several Govt, 
and private players who are interested to provide solutions analyzing the 
same data. The solutions are basically analytical outcomes for suitable 
quarantine measures and proposed self-care solutions. 

4. The empowered committee with the vested powers from the Disaster 
Management Act, 2005 has developed a guideline document for entire 
lifecycle of data governance related to Covidl9 pandemic. The main 
features of such a data process protocol are as follows: 

i. Identify the data types, their source of collection and establishing the 
need for personal data parameters to be included. Further identify 
organizations for doing relevant data analytics essential for the 
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purpose of preparing for, mitigating, managing and efficiently 
addressing a disaster. 

ii. To oversee the functioning of the various state agencies, and where 
necessary, seek inputs from the State Executive Committees on the 
disaster-related data in their possession 

iii. To lay out guidance/ SOP for various state agencies to oversee all 
activities of the District Authorities, and where necessary, seek inputs 
from the District Authorities on the disaster-related data in their 
possession 

iv. To lay out guidance /SOP for the collection ,storage , processing and 
restrictions of the identified disaster-related data 

v. To lay out guidance /SOP for cessation, handling of data breaches and 
security of the disaster related data 

5. The empowered committee will issue relevant notifications /orders in 
accordance with the requirements as stated in point 4. 

6. To effectively develop the relevant guidance and SOP for the effective 
data process and control MeitY approached three different law firms (PLR 
Chambers, Vidhi Legal and Adv. Vakul Sharma) to develop such 
rules/guidance/SOP under relevant powers of NDMA act. Consultations 
were carried out with them to arrive at the legally sustainable way 
forward. Initially it was proposed that such rules may be notified under a 
relevant section of the Information Technology (IT) Act, but further 
detailed discussion led to the conclusion that IT Act does not give powers 
for collection of data from any agency. Further Section 43A only gives 
powers to make rules for secure data processing by body corporate only. 
In view of the above, it was concluded that such rules/guidance need to 
draw powers from NDMA Act. The same was agreed with all the three law 
firms and further discussion was held with them. 

7. Based on the discussion and analysis of the new set of documents 
provided by these law firms, it was felt that draft rules proposed by Adv. 
Vakul Sharma is much simpler. The rules is proposed to be notified in 
exercise of the powers conferred by sub-section (1) of section 75 of the 
Disaster Management Act, 2005 read with clause (d) of sub-section (2) of 
section 35 of the Disaster Management Act 2005 (53 of 2005). The brief 
features of the above rule are as follows: 

i. Collection of public health emergency data by the National Authority 

ii. Obligations of the designated ministry or department or government 
agency collecting, processing and retaining public health emergency 
data 

iii. Role of the designated ministry or department in providing public 
health emergency data, or personal information 
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iv. Obligations of entities accessing anonymised and aggregated public 
health emergency data 

v. Public access of health emergency data by designated ministry or 
department or agency of Government 

8. The above prima facie meets the requirements and expectations as 
specified during our initial discussions. The Rules and corresponding 
notification designating NIC as the Govt. Agency for processing of data for 
the above rule is placed opposite. 

Kind approval is solicited for notifying the said rules under NDMA Act 
and corresponding notification thereof. 


Dr. S. Sathyanarayanan 
Scientist D, CLBS 


' Draft_Collection and Processing of Health Data Rules_vl_MeitY.pdf 
Notification of MeitY as the designated ministry.pdf 

08/04/2020 2:55 PM 

S.Sathyanarayanan 

(SCIC(SS)-CL&ES) 


Note No. #2 


08/04/2020 7:10 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #3 


The draft NDM(EDP) Rules 2020 as proposed can be recommended to MHA. 
The key feature is that responsibility for regulating data handling is being 
delegate to the National Executive Committee chaired by the Home 
Secretary that has also constituted Empowered Groups to look at 
specific areas in relation to handling Covid 19 response. The rules are 
Generic and can be used in any case any such disaster response. 


08/04/2020 7:55 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 


Note No. #4 
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08/04/2020 8:35 PM 


Ajay Sawhney 
(Secretary) 


Note No. #5 


08/04/2020 9:36 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 


Note No. #6 

SD(PK) has not been able to use the remore e-Office facility. Hence the file is 
returned to JD(Sathya). The approval has been conveyed to SD(PK) as well 
verbally for further necessary action. May be brought to his attention. 


08/04/2020 10:05 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #7 

Subject: Guidelines for the data process protocol for 

Covidl9 related data 


Reference Pre-page notings: 

Secretary on 9.4.2020 had written to Union Home Secretary 
forwarding therewith draft Disaster Management (Processing of the Public 
Health Emergency Data) Rules, 2020 and Notification to designate NIC as the 
government agency to process health related data. The proposed Rules and 
Notification are to be issued by Ministry of Home Affairs (MHA) under the 
National Disaster Management Act. 

2. Now vide Order No. 17(4)/2020-Pers.I dated 15.04.2020, MeitY has 
constituted a Committee with JS(JM) and Sc-F(KB) to provide support to the 
Empowered Group on Technology and Data Management chaired by 
Secretary. 

3. Accordingly the file is forwarded to JS(JM) for taking up the matter 
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with MHA for notification of the said Rules and notifying NIC as the 
designated agency. Shri Sanjeev Kumar Jindal, JS(DM), MHA (Ph : 
23092722) is concerned officer in MHA dealing with the subject. 

Submitted please. 


Dr. S. Sathyanarayanan 
Scientist D, Cyberlaw Group 

16-04-2020 

SD(PK) 

GC(RM) 

AS 

JS(JM) 

1586944733_Covid_Committee_support.pdf 
16/04/2020 12:39 PM 

S.Sathyanarayanan 

(SCIC(SS)-CL&ES) 


Note No. #8 

In view of Support Group with JS(JM) and Sc-F(KB) created by MeitY, the subject 
matter alongwith relevent documents may be sent to this Group for futher 
follow-up. (Prafulla Kumar) 


16/04/2020 12:47 PM 


PRAFULLA KUMAR 
(SCIENTIST G) 


Note No. #9 


16/04/2020 3:19 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #10 

This will not be in their purview.. This is purely IT Act stuff related to data 
governance and for such time can be continued to be handled in CLES division. 
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17/04/2020 2:06 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 


Note No. #11 


17/04/2020 3:02 PM 


Ajay Sawhney 
(Secretary) 


Note No. #12 


17/04/2020 3:17 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 


Note No. #13 


20/04/2020 5:57 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #14 


I have talked to JS(Disaster Management), MHA. They have further sought input 
from Secretary, MohFW and Secretary,NDMA on the draft Rules. 


21/04/2020 11:23 AM 


PRAFULLA KUMAR 
(SCIENTIST G) 


Note No. #15 


24/04/2020 11:10 AM 


S.Sathyanarayanan 

(SCIC(SS)-CL&ES) 
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Note No. #16 

As a follow-up, I had sent a mail to JS(Disaster Management), MHA on 
20.04.2020 requesting for latest status of the notification of the Rules. 
(Attached) 

Again on 23.04.2020, spoke to Shri Manoj Kasana, Di recto r( Disaster 
management),MHA [Mob-8447138689, Tel-23428122], regarding status of 
notification of the proposed Rules for processing of COVID-19 related data. He 
informed that MHA has sought comments from MoHFW on the proposed Rules 
and comments are still awaited. (Attached) 

The matter was also discussed in the Empowered Group-9 meeting held on 
18.04.2020, where the status update was provided. 

To expedite the matter, it is requested that AS may like to write to AS(DM), 
MHA. A draft letter is attached for kind approval. 


GC(RM) 

AS 

$ email-JS(DM)-MHA-20April2020.pdf 
if mail-MHA-23April2020.pdf 

24/04/2020 1:17 PM 


Prafulla Kumar 
Scientist-G 
24.04.2020 


PRAFULLA KUMAR 
(SCIENTIST G) 


Note No. #17 


24/04/2020 2:18 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #18 


Yes . Draft modified & it can be sent to AS MHA. 


24/04/2020 3:01 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 
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Note No. #19 


24/04/2020 3:47 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #20 


I think email has been sent to AS MHA 


25/04/2020 9:51 AM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 


Note No. #21 


27/04/2020 12:53 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #22 

We had been following up with MHA for notification of the Rules. I had sent 
emails to JS(DM), MHA Subsequently AS also had written to AS(UT), MHA to 
expedite notification of the Rules. 


Ministry of Home Affairs has sought the views of Ministry of Health and Family 
Welfare (MoHFW) and National Disaster Management Authority (NDMA) on the draft 
of Rules proposed by us. Instead of waiting for a formal response, considering the 
present requirements, it is proposed that a meeting could be held chaired by Union 
Home Secretary with participation of MeitY, MoHFW and NDMA in order to resolve 
and address any concerns about the proposed draft. There have already been many 
court cases in the High Court of Kerala regarding handling of health data and 
sharing with companies for analytics etc. Also, there have been concerns in the 
media about the need for a data protection framework with respect to various apps 
that have been rolled out by the Central Government and the states in their efforts 
to tackle Covid-19. 


It is important that MHA notifies the proposed Rules so that necessary framework is 
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in place regarding processing of sensitive data during disasters. 


Accordingly a draft letter from Secretary to Home Secretary is attached for kind 
approval, please. 


01/05/2020 12:19 PM 


PRAFULLA KUMAR 
(SCIENTIST G) 


Note No. #23 

A meeting was held on 2nd may,2020 in the office of Secretary Home. Secretary 
MeitY, AS(GS) and the undersigned attended from MeitY side. Reps of NDMA 
sivision, MHA and MOhFW were also there. 


The need for issue of such a rule was discussed in detail. 

However, Secretary Home decided that issue of any rule on data collection, 
processing and storage may not be warranted under NDMA. A guideline 
document/ order may be issued by MeitY under the existing IT Act or through the 
empowered committee constituted under NDMA on the data Management. 


Accordingly, the present rule in its existing form is being dropped. Further, AS is 
having interaction with Vidhi Legal to come with a suitable document based on 
these rules. We will initiate action as and when necessary. 


03/05/2020 3:07 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #24 
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06/05/2020 6:23 PM 


PRAFULLA KUMAR 
(SCIENTIST G) 


Note No. #25 

It has been decided to issue the an order for "Notification of the Aarogya Setu 
Emergency data Access and Knowledge sharing Protocol,2020" by Secretary, 
MeitY as Chairperson, Empowered Group 9 constituted by national Excecutive 
Committee of the national Disaster Management Authority. 

A draft notification is attached. 


06/05/2020 6:35 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #26 


06/05/2020 6:37 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 


Note No. #27 


Please process with amended draft. 

08/05/2020 7:21 PM 


Ajay Sawhney 
(Secretary) 


Note No. #28 


08/05/2020 8:38 PM 


GOPALAKRISHNAN S 
(ADDITIONAL SECRETARY) 
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Note No. #29 


09/05/2020 8:28 PM 


RAKESH MAHESWARI 
(SCIENTIST G) 


Note No. #30 


File may be retained in section. 


06/07/2020 10:58 AM 


PRAFULLA KUMAR 
(SCIENTIST G) 


Note No. #31 


Shri Vinod Chouhan, Sci "D" has requested to send the subject file for replying to 
RTI Application. Accordingly, the file is forwarding to him. The matter has been 
brought into the knowledge of SD(PK). 


Submitted please. 

06/07/2020 4:23 PM 


Sh. Mahesh Kumar Jain 
(SO(MKJ)-G2) 


Note No. #32 


06/07/2020 4:58 PM 


Vinod Kumar Chouhan 
(SCIC(VKS)-CL&ES) 
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ORDER 

Subject: Notification of the Aarogya Setu Emergency Data Access and Knowledge 
Sharing Protocol, 2020 in light of the COVID-19 pandemic 


WHEREAS, the Aarogya Setu App is a useful technological solution developed to facilitate 
contact tracing of persons infected with COVID-19, inform persons at-risk of such infected 
persons and precautions to be taken, and allow health departments to take effective actions to 
mitigate the spread of the pandemic and enhance their preparedness; 

WHEREAS, vide Orders No. 40-3/2020-DM-l(A) dated 29.03.2020 and 01.05.2020, the 
Central Government has constituted Empowered Groups under the Disaster Management Act, 
2005 to identify problem areas and provide effective solutions therefor, delineate policy, 
formulate plans, strategise operations and take all necessary steps for effective and time-hound 
implementation of these plans/policies/ strategies/ decisions in relation to the Covid-19 
pandemic; 

WHEREAS, under these Orders, the National Executive Committee of the National Disaster 
Management Authority has created the Empowered Group 9 on Technology and Data 
Management (“Empowered Group”). 

WHEREAS, the functioning of the Aarogya Setu mobile application relates to technology and 
data management and certain necessary steps require to be taken to ensure its effective 
operation to detect and mitigate the spread of the COVID-19 pandemic and enhance 
government preparedness at all levels; 

NOW THEREFORE, in order to ensure secure collection of data by the Aarogya Setu mobile 
application, protection of personal data of individuals, and the efficient use and sharing of 
personal or non-personal data for mitigation and redressal of the COVID-19 pandemic, the 
undersigned, in his capacity as Chairperson, Empowered Group on Technology and Data 
Management, hereby issues the Aarogya Setu Emergency Data Access and Knowledge Sharing 
Protocol, 2020 (enclosed) for necessary compliance. 


Ajay Sawhney, 

Chairperson, Empowered Group 9 on Technology and Data Management 


1 
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Aarogya Setu Emergency Data Access and Knowledge Sharing Protocol 2020 
Rationale for this protocol: 

1. Owing to the COVID-19 pandemic, guidelines have been issued by the Ministry of 
Home Affairs (vide Orders dated 24.03.2020, 25.03.2020, 28.03.2020, 1.04.2020, 
2.04.2020, 14.04.2020, 16.04.2020, 1.05.2020) on the measures to be taken by the 
Central Government as well as the State/Union Territory Governments. Various 
advisories and statements have been issued by the Ministry of Health and Family 
Welfare, and other Ministries of the Government of India and State/ Union Territory 
Governments on precautionary measures such as social distancing and treatment of 
individuals who are affected or are at-risk. In order to ensure their effective 
implementation, there is a need to ensure efficient data and information sharing among 
the different Departments and Ministries of the Government of India as well as those 
in the State/Union Territory Governments. 

2. At present, the Government of India and State/Union Territory Governments are tasked 
with formulating critical health responses to not only contain the epidemic but also 
protect the health and safety of the community at large. Here, critical health responses 
include prevention and management of the COVID-19 pandemic, syndromic mapping, 
contact tracing, communication to an affected or at-risk individual’s family and 
acquaintances, performance of statistical analysis, medical research, formulation of 
treatment plans or other medical and public health responses related to the redressal and 
management of the COVID-19 pandemic. 

3. In order to formulate critical health responses for addressing the COVID-19 pandemic, 
data pertaining to individuals is urgently required. Here individuals means persons who 
are infected, at high risk of being infected or who have come in contact with infected 
individuals. This data includes demographic data, contact data, self assessment data and 
location data (collectively called ‘response data’ in this document). Here, 
demographic data means the name, mobile number, age, gender, profession and travel 
history of an individual. Contact data means data about any other individual that a 
given individual has come in close proximity with including the duration of the contact, 
the proximate distance between the individuals and the geographical location at which 
the contact occurred. Self assessment data means the responses provided by that 
individual to the self assessment test administered within the Aarogya Setu mobile 
application. Location data means data about the geographical position of an individual 
in latitude and longitude. 


4. Implementation of the Protocol: 

Keeping in view the above, the Ministry of Electronics and Information Technology, 
Government of India (“MeitY”) is designated as the agency responsible for the 
implementation of this Protocol and its developer, the National Informatics Centre 
shall, under this Protocol be responsible for collection, processing and managing 

2 
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response data collected by the Aarogya Setu mobile application,. Any reference to 
MeitY under this Protocol is a reference to its supervisory role in relation to the Aarogya 
Setu mobile application and its developer, the National Informatics Centre and not in 
any other capacity. For the purpose of this Protocol, MeitY shall act under the overall 
direction of the Empowered Group on Technology and Data Management 
(“Empowered Group”) created by the National Executive Committee of the National 
Disaster Management Authority. 

5. Principles for collection and processing of response data: 

a. Any response data and the purpose for which it is collected by NIC shall be 
clearly specified in the Privacy Policy of the Aarogya Setu mobile application. 

b. NIC shall collect only such response data as is necessary and proportionate to 
formulate appropriate critical health response. Further, such data shall be used 
strictly for the purpose of formulating and implementing aappropriate critical 
health response. 

c. NIC shall process any data collected by it in a fair, transparent and non- 
discriminatory manner. 

d. Contact and location data shall by default, remain on the device on which the 
Aarogya Setu mobile application has been installed after such data has been 
collected. It may be uploaded to the server only for the puipose of formulating 
and implementing the appropriate critical health response. 

e. Contact, location and self assessment data of an individual that has been 
collected by NIC shall not be retained beyond the period necessary to meet the 
puipose for which it is obtained which, unless a specific recommendation to this 
effect is made in the review under Para 10 of this Protocol, shall not ordinarily 
extend beyond 180 days from the date on which it is collected, after which such 
data shall be permanently deleted. Demographic data of an individual that has 
been collected by NIC shall be retained for as long as this Protocol remains in 
force. 

f. The response data shall be securely stored by NIC and shall only be shared in 

accordance with this Protocol. 

6 . Principles for sharing of response data: 

The response data may be shared by NIC in the following manner: 

a. Response data in de-identified form may be shared with Ministries or 
Departments of the Government of India or the State/Union Territory 
Governments, local governments and other public health institutions of the 
Government of India or State Governments or local governments where such 
sharing is necessary to formulate or implement a critical health response. Here, 
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de-identified form means data which has been stripped of personally 
identifiable data to prevent the individual from being personally identified 
through such data and assigned a randomly generated ID. 

b. Response data containing personal data may be shared with the Ministry of 
Health and Family Welfare, Government of India, Departments of Health of the 
State/Union Territory Governments/ local governments and other public health 
institutions of the Government of India, State Governments and local 
governments where such sharing is strictly necessary to formulate or implement 
a critical health response. 

c. Response data, whether as de-identified response data or containing personal 
data, shall only be shared with private entities if it is strictly necessary to 
formulate or implement a critical health response and any such private entity 
shall be subject to the obligations laid out in clause 7(b) of this Protocol. 

d. NIC shall, to the extent reasonable, document the sharing of any data under Para 
6 and maintain a list of the agencies with whom such data has been shared. Such 
documentation shall include the time at which such data sharing was initiated, 
the persons or agencies who are being provided access to such data, the 
categories of data that are being shared and the purpose for which such data is 
being shared. 

7. Obligations of entities with whom response data is shared: 

An entity with whom response data is shared under this Protocol shall have the following 
obligations: 

a. Any Ministry or Department of the Government of India or State/ Union 
Territory Government/ local government with whom response data has been 
shared under this Protocol shall use such data strictly for the puipose for which 
it is shared. Such Ministry or Department, State/Union Territory shall process 
response data in a fair, transparent and non-discriminatory manner, and to the 
extent reasonable, shall document the use of such data, specifying the time at 
which such data was accessed, the persons who have accessed such data, the 
categories of data accessed and the purpose for which such data has been 
accessed. The data accessed and used by such entities should not be retained 
beyond the period necessary to satisfy the puipose for which it is shared. In any 
circumstance, such data shall not ordinarily be retained beyond 180 days from 
the date on which it was accessed, after which such data shall be permanently 
deleted. Any Ministry or Department shall also implement reasonable security 
practices and procedures as prescribed under any law for the time being in force. 
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b. Any private entity with whom response data has been shared under this Protocol 
by any Ministry or Department of the Government of India or State/ Union 
Territory Government/ local government or public health institution in the 
Government of India, State Governments and local governments shall only use 
and process such data for the purpose for which it is shared which shall only be 
for a purpose related to prevention and management of the COVID-19 
pandemic. Every such private entity shall identify a nodal person who shall be 
in a leadership role and who shall be responsible for ensuring compliance with 
this Protocol. Any private entity which obtains access to response data under 
this Para shall implement reasonable security practices and procedures as 
prescribed under any law for the time being in force. It shall process response 
data in a fair, transparent and non-discriminatory manner, and to the extent 
reasonable, shall document the use of such data, in a manner that facilitates 
audits and reviews by the Central Government, specifying the time at which 
such data was accessed, the persons who have accessed such data, the categories 
of data accessed and the purpose for which such data has been accessed. Any 
private entity provided access to response data under this Para shall not re-use 
such data, disclose it to any other third-party, or retain it for longer period than 
is required in order to serve the puipose for which access was provided which 
shall, in no event, exceed 180 days from the date on which access was provided, 
after which it shall be permanently deleted. 

c. Any response data accessed under clause 7(a) shall ordinarily not be onward 
shared with any third party, including any private entity. However, response 
data may be shared with such third parties only if it is strictly necessary to 
formulate or implement a critical health response. The Ministry or Department 
of the Government of India or State/ Union Territory Government/ local 
government or public health institution of the Government of India/ State 
Governments/ local governments that is sharing such information shall remain 
responsible for adherence to this Protocol by any other entity with which it 
shares information. In this context, any private entity with whom such data is 
shared shall be subject to the same obligations as under clause 7 (b). 

8 . Principles for sharing of response data for research purposes: 

Response data may be made available for research purposes by NIC in the following manner: 

a. Response data which has undergone hard anonymisation, as under clause 8(c), 
may be made available on a non-discriminatory basis to Indian universities and 
research institutions registered in India, whether public or private. 

b. Any university or research institution seeking to access response data under 
clause 8(a) shall make a request for such data to the Empowered Group, who 
may approve of such request and provide access to this data only if it is of the 
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view that such access is sought for the purposes of statistical, epidemiological, 
scientific or any other form of academic research, on such terms as may be 
stipulated by the Empowered Group in this behalf. 

c. In this Para, hard anonymisation refers to a series of technical processes which 
ensure that any individual is incapable of being identified from the response 
data through any means reasonably likely to be used to identify such individual. 
This anonymisation shall be done in accordance with anonymisation protocols 
as may be specified by the Empowered Group. These anonymisation protocols 
shall be reviewed and updated by the Empowered Group on a periodic basis, 
based on an analysis and recommendations of an academic committee of global 
stature appointed by the Principal Scientific Advisor to the Government of 
India. Such review shall have regard to the nature and sensitivity of the data 
being processed, the robustness of the anonymisation protocol and advances in 
technology. 

d. Any university or research institution which accesses anonymised response data 
under this Para shall not onward share such response data with any third party, 
or reverse anonymise such data or re-identify individuals in any manner. If any 
person knowingly or unknowingly, takes any action which has the effect of such 
data no longer remaining anonymised, any rights granted to them under this 
Protocol shall stand terminated, and they shall be liable for penalties under all 
applicable laws for the time being in force. 

9. Violation of this Protocol: 

Any violation of this Protocol shall lead to applicable penalties as per the Disaster 
Management Act, 2005. 

10. Sunset Clause: 

The Empowered Group shall review this Protocol after a period of 6 months from the 
date of this notification or may do so, at such earlier time as it deems fit. Unless 
specifically extended by the Empowered Group on account of the continuation of the 
COVID-19 pandemic in India, this Protocol shall be in force for 6 months from the date 
on which it is issued. 
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